ghsa-9xpj-62mm-24h2
Vulnerability from github
Published
2024-06-14 09:31
Modified
2024-06-17 21:24
Summary
Apache Airflow does not return the "Cache-Control" header for dynamic content
Details
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.
Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.
This issue affects Apache Airflow: before 2.9.2.
Users are recommended to upgrade to version 2.9.2, which fixes the issue.
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "apache-airflow" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.9.2" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2024-25142" ], "database_specific": { "cwe_ids": [ "CWE-525" ], "github_reviewed": true, "github_reviewed_at": "2024-06-17T21:24:09Z", "nvd_published_at": "2024-06-14T09:15:09Z", "severity": "LOW" }, "details": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.\u00a0\n\nAirflow did not return \"Cache-Control\" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.\n\nThis issue affects Apache Airflow: before 2.9.2.\n\nUsers are recommended to upgrade to version 2.9.2, which fixes the issue.\n\n", "id": "GHSA-9xpj-62mm-24h2", "modified": "2024-06-17T21:24:09Z", "published": "2024-06-14T09:31:17Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25142" }, { "type": "WEB", "url": "https://github.com/apache/airflow/pull/39550" }, { "type": "WEB", "url": "https://github.com/apache/airflow/commit/94eb647de692a4d9555b02dce85974da5d4c04e3" }, { "type": "PACKAGE", "url": "https://github.com/apache/airflow" }, { "type": "WEB", "url": "https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr" } ], "schema_version": "1.4.0", "severity": [], "summary": "Apache Airflow does not return the \"Cache-Control\" header for dynamic content" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.